CERT home
vulnerabilities & fixesevaluations & practicesresearch & analysistraining & education
homesearchFAQsite indexcontact
Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information
 

 View Notes By
Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric

Vulnerability Note VU#878044

SNMPv3 improper HMAC validation allows authentication bypass

Overview

A vulnerability in the way implementations of SNMPv3 handle specially crafted packets may allow authentication bypass.

I. Description

SNMP can be configured to utilize version 3, which is the current standard version of SNMP. SNMPv3 incorporates security features such as authentication and privacy control among other features. Authentication for SNMPv3 is done using keyed-Hash Message Authentication Code (HMAC), a message authentication code calculated using a cryptographic hash function in combination with a secret key. Implementations of SNMPv3 may allow a shortened HMAC code in the authenticator field to authenticate to an agent or a trap daemon using a minimum HMAC of 1 byte.

This issue is known to affect Net-SNMP and UCD-SNMP. Other SNMP implementations may also be affected.

II. Impact

This vulnerability allows attackers to read and modify any SNMP object that can be accessed by the impersonated user. Attackers exploiting this vulnerability can view and modify the configuration of these devices.

III. Solution

Upgrade

This vulnerability is addressed in Net-SNMP versions 5.4.1.1, 5.3.2.1, 5.2.4.1, 5.1.4.1, 5.0.11.1 and UCD-SNMP 4.2.7.1. Please see the Net-SNMP download page.

Alternatively, consult your vendor. See the Systems Affected section below for more information.

Apply a patch

Net-SNMP has released a patch to address this issue. For more information refer to SECURITY RELEASE: Multple Net-SNMP Versions Released. Users are encouraged to apply the patch as soon as possible. Note that patch should apply cleanly to UCD-snmp too.

Enable the SNMPv3 privacy subsystem

The configuration should be modified to enable the SNMPv3 privacy subsystem to encrypt the SNMPv3 traffic using a secret, private key. This option does not encrypt the HMAC, but does minimize the possible affects from this vulnerability.

Systems Affected

VendorStatusDate Updated
3com, Inc.Unknown2008-05-202008-05-20
ACCESSUnknown2008-06-022008-06-02
AdventNet Inc. Not Vulnerable2008-06-132008-06-18
AlcatelUnknown2008-05-202008-05-20
Apple Computer, Inc.Unknown2008-06-022008-06-02
Aruba Networks, Inc.Unknown2008-05-202008-05-20
Asante Technologies, Inc.Unknown2008-06-132008-06-13
Atheros Communications, Inc.Unknown2008-06-132008-06-13
AT&TUnknown2008-05-202008-05-20
Avaya, Inc.Unknown2008-05-202008-05-20
Avici Systems, Inc.Unknown2008-05-202008-05-20
BEA Systems, Inc. Unknown2008-06-132008-06-13
Borderware TechnologiesUnknown2008-05-202008-05-20
BroUnknown2008-05-202008-05-20
BroadcomUnknown2008-06-132008-06-13
Charlotte's Web NetworksUnknown2008-05-202008-05-20
Check Point Software TechnologiesUnknown2008-05-202008-05-20
Cisco Systems, Inc.Unknown2008-05-202008-06-13
ClavisterUnknown2008-05-202008-05-20
Computer AssociatesNot Vulnerable2008-05-202008-06-20
Computer Associates eTrust Security ManagementNot Vulnerable2008-05-202008-06-20
Conectiva Inc.Unknown2008-05-202008-05-20
CosinecomUnknown2008-06-132008-06-13
Covalent TechnologiesUnknown2008-06-132008-06-13
cPanel Inc.Unknown2008-06-132008-06-13
Cray Inc.Unknown2008-05-202008-05-20
Cyclades, Inc.Unknown2008-06-132008-06-13
D-Link Systems, Inc.Unknown2008-05-202008-05-20
Data Connection, Ltd.Unknown2008-05-202008-05-20
Debian GNU/LinuxUnknown2008-05-202008-05-20
eCosCentricVulnerable2008-06-13
EMC CorporationUnknown2008-05-202008-05-20
Engarde Secure LinuxUnknown2008-05-202008-05-20
Enterasys NetworksUnknown2008-05-202008-05-20
EricssonUnknown2008-05-202008-05-20
eSoft, Inc.Unknown2008-05-202008-05-20
Extreme NetworksVulnerable2008-05-202009-04-22
F5 Networks, Inc.Unknown2008-05-202008-05-20
Fedora ProjectUnknown2008-05-202008-05-20
Force10 Networks, Inc.Not Vulnerable2008-05-202008-06-12
Fortinet, Inc.Not Vulnerable2008-05-202008-05-27
Foundry Networks, Inc.Not Vulnerable2008-05-202008-06-17
FreeBSD, Inc.Unknown2008-05-202008-05-20
FujitsuUnknown2008-05-202008-05-20
Funkwerk Enterprise Communications Not Vulnerable2008-06-18
Gentoo LinuxUnknown2008-06-042008-06-04
Global Technology AssociatesVulnerable2008-05-202009-07-16
Harris CorporationUnknown2008-06-132008-06-13
Hewlett-Packard CompanyUnknown2008-05-202008-05-20
HitachiUnknown2008-05-202008-05-20
HyperchipUnknown2008-05-202008-05-20
IBM CorporationNot Vulnerable2008-05-202008-06-18
IBM Corporation (zseries)Unknown2008-05-202008-05-20
IBM eServerUnknown2008-05-202008-05-20
Ingrian Networks, Inc.Unknown2008-05-202008-05-20
Inktomi Corporation (now Yahoo!)Unknown2008-06-132008-06-13
Intel CorporationNot Vulnerable2008-05-202008-05-21
Internet Initiative JapanVulnerable2008-06-19
Internet Security Systems, Inc.Not Vulnerable2008-05-202008-06-04
IntotoUnknown2008-05-202008-05-20
IP FilterUnknown2008-05-202008-05-20
IP Infusion, Inc.Unknown2008-05-202008-05-20
Juniper Networks, Inc.Vulnerable2008-05-202008-06-09
LantronixUnknown2008-06-132008-06-13
Linux Kernel ArchivesUnknown2008-05-202008-05-20
Lotus SoftwareUnknown2008-06-132008-06-13
Lucent TechnologiesUnknown2008-05-202008-05-20
Luminous NetworksUnknown2008-05-202008-05-20
m0n0wallUnknown2008-05-202008-05-20
Mandriva, Inc.Unknown2008-05-202008-05-20
Marconi, Inc.Unknown2008-06-132008-06-13
McAfeeUnknown2008-05-202008-05-20
MetaSwitchUnknown2008-06-132008-06-13
Metrobility, Inc.Unknown2008-06-132008-06-13
Microsoft CorporationNot Vulnerable2008-05-202008-05-28
MontaVista Software, Inc.Unknown2008-05-202008-05-20
Motion Media Technologies, Inc.Unknown2008-06-132008-06-13
Multinet (owned Process Software Corporation)Unknown2008-05-202008-05-20
Multitech, Inc.Unknown2008-05-202008-05-20
NEC CorporationUnknown2008-05-202008-05-20
Net-PolicyUnknown2008-06-13
NetBSDUnknown2008-05-202008-05-20
netfilterUnknown2008-05-202008-05-20
Netgear, Inc.Unknown2008-06-132008-06-13
Netscape Communications CorporationUnknown2008-06-132008-06-13
netsnmpVulnerable2008-05-162008-06-10
netsnmpjUnknown2008-06-13
Network Appliance, Inc.Vulnerable2008-05-202008-06-04
NextHop Technologies, Inc.Unknown2008-05-202008-05-20
NokiaUnknown20-May-2008
Nortel Networks, Inc.Unknown2008-05-202008-05-20
Novell, Inc.Not Vulnerable2008-05-202008-06-04
OpenBSDUnknown2008-05-202008-05-20
openSNMPUnknown2008-06-13
Openwall GNU/*/LinuxUnknown2008-05-202008-05-20
Oracle CorporationUnknown2008-06-132008-06-13
PolycomUnknown2008-06-132008-06-13
QNX, Software Systems, Inc.Unknown2008-05-202008-05-20
QuaggaUnknown2008-05-202008-05-20
QUALCOMM IncorporatedUnknown2008-06-132008-06-13
Rad Vision, Inc.Unknown2008-06-132008-06-13
Red Hat, Inc.Vulnerable2008-05-202008-06-06
Redback Networks, Inc.Unknown2008-05-202008-05-20
Riverstone Networks, Inc.Unknown2008-05-202008-05-20
Secure Computing Network Security DivisionUnknown2008-05-202008-05-20
Secureworx, Inc.Unknown2008-05-202008-05-20
Silicon Graphics, Inc.Unknown2008-05-202008-05-20
Slackware Linux Inc.Unknown2008-05-202008-05-20
SmoothWallUnknown2008-05-202008-05-20
SNMP ResearchVulnerable2008-06-06
SnortUnknown2008-05-202008-05-20
Soapstone NetworksUnknown2008-06-022008-06-02
Sony CorporationUnknown2008-05-202008-05-20
SourcefireUnknown2008-05-202008-05-20
StonesoftNot Vulnerable2008-05-202008-06-23
Sun Microsystems, Inc.Vulnerable2008-05-202008-06-16
SUSE LinuxUnknown2008-05-202008-05-20
Symantec, Inc.Unknown2008-05-202008-05-20
The SCO GroupUnknown2008-05-202008-05-20
The Teamware GroupUnknown2008-06-132008-06-13
TippingPoint, Technologies, Inc.Not Vulnerable2008-05-202008-05-21
Trustix Secure LinuxUnknown2008-05-202008-05-20
TurbolinuxUnknown2008-05-202008-05-20
UbuntuUnknown2008-05-202008-05-20
Vertical Networks, Inc.Unknown2008-06-132008-06-13
Watchguard Technologies, Inc.Unknown2008-05-202008-05-20
Wind River Systems, Inc.Unknown2008-05-202008-05-20
ZyXELUnknown2008-05-202008-05-20

References


http://sourceforge.net/forum/forum.php?forum_id=833770
http://www.ocert.org/advisories/ocert-2008-006.html
http://secunia.com/advisories/30574/
http://secunia.com/advisories/30665/
http://sunsolve.sun.com/search/document.do?assetkey=1-66-238865-1

Credit

This issue was reported by Wes Hardaker at Net-SNMP. Thanks also to Jeff Case of SNMP Research and oCERT.

This document was written by Chris Taschner and David Warren.

Other Information

Date Public05/31/2008
Date First Published06/10/2008 09:59:27 AM
Date Last Updated07/16/2009
CERT Advisory 
CVE NameCVE-2008-0960
Metric7.56
Document Revision36

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

Copyright 2008 Carnegie Mellon University